strace is a debugging utility for tracing system calls and signals under Linux.

learn more… | top users | synonyms

1
vote
1answer
20 views

where does go data written to file descriptor that was never opened

I have output captured by following command: $ strace -f -e trace=process,socketpair,open,close,dup,dup2,read,write -o rsync.log rsync -avcz --progress src/ dst/ it is a bit long so I've uploaded ...
1
vote
0answers
16 views

strace for troubleshooting inter process communication

I have output captured by following command: strace -f -e trace=process,socketpair,open,close,dup,dup2,read,write -o rsync.log rsync -avcz --progress src/ dst/ it is a bit long so I've uploaded it ...
2
votes
1answer
52 views

Strace output not showing system call

I am reading the source code of coreutils and I came to read tty.c code. Main function of tty is as follows: int main (int argc, char **argv) { char *tty; int optc; initialize_main (&argc, ...
0
votes
1answer
31 views

qemu infinite loop on boot

I'm currently trying to set up a virtual machine emulating a ARMv7 Cortex-A8 on a x64 host running qemu. I've got a zImage which was built with the realview defconfig and a rootfs in cpio format. ...
2
votes
2answers
29 views

ptrace suid binaries after privilege is dropped

I understand that we probably cannot do ptrace on suid binaries. However, I'm wondering why we cannot do ptrace after the binary drops its previlege to uid instead of euid. For example, in the binary ...
1
vote
2answers
83 views

Exclude PIDs when comparing strace output

I want to debug like: strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello.log strace -fe open python /usr/bin/gnome-tweak-tool 2>>/tmp/hello2.log Then use kdiff3 to compare ...
1
vote
3answers
139 views

How can I find which user is accessing a file using strace?

My actual problem is that Nginx is not able to render pages (403 forbidden) despite the permissions being set to appropriately (in my opinion) The directory of stackoverflow at default location: ...
0
votes
0answers
74 views

What differences are between running a command in shell with and without `bash -c`?

What is the difference of running a command directly in a bash shell, and run it as bash -c <command> in a bash shell? The purpose of my question is that I would like to know how a command is ...
0
votes
0answers
59 views

Compare running a command directly and in background

In Ubuntu, I run date in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. By using tracing, I would like to ...
1
vote
1answer
98 views

How to understand the output of tracing running an external command in bash?

In Ubuntu, I run date directly in an interactive bash shell whose pid is 6913. $ date Wed Mar 2 23:57:44 EST 2016 At the same time, I trace the bash shell 6913 from another interactive bash shell ...
1
vote
0answers
70 views

How to understand the output of tracing running an external command in background via strace

In Ubuntu, I run date & in an interactive bash shell whose pid is 6913, and at the same time, trace the bash shell from another interactive bash shell by strace. The output of tracing the first ...
0
votes
2answers
80 views

Why doesn't strace report that the parent shell fork() a child process before execve() a command?

strace runs a specified command until it exits. It intercepts and records the system calls which are called by a process and the signals which are received by a process. When running an external ...
2
votes
2answers
56 views

How can strace monitor itself?

I have a Hypothetical Situation. (1) Let us say we have two strace Processes S1 & S2, which are simply monitoring each other. How can this be possible ? Well, in the command-line options for ...
1
vote
1answer
45 views

Most elegant way to terminate straced program

I want to capture a certain thing with strace and then immediately exit. This way the program stays alive: strace ... program 2>&1 | grep --line-buffered ... | read line. Is there a simple way ...
1
vote
1answer
77 views

exit status of command is different when it is run via strace

I can normaly mount/umount FTP as file system using following commands: └──> curlftpfs -o codepage=windows-1250 anonymous:anonymous@192.168.3.13 /home/marek/ftpfs └──> ls /home/marek/ftpfs/ 1 2 ...
2
votes
2answers
159 views

Debugging a kernel shut down?

I'm on Linux 4.2.0, the Ubuntu Wily HWE kernel for Ubuntu 14.04 (which is what I'm running). There's a nasty bug on MacBook 11,4 and 11,5 models where the laptops won't actually ever shut off, they ...
4
votes
0answers
157 views

Linux strace not following child processes even with -f (multithreaded parent)

Note: there are several similar questions, with the general answer being "If you want to trace a multithreaded process, or follow children, use -f". This doesn't help me, as i am using -f already. I ...
1
vote
0answers
30 views

How to debug a bash script in a qemu-arm chroot

I'm running a debian debootstrap script which creates an arm system. However, the script fails at some point and the error message does not really help. So I'll have to do some more debugging which is ...
1
vote
0answers
16 views

How can I see file events of all processes matching those with keyword in path?

How can I see file events of all processes matching only those with keyword in path ? Here is my typical usecase. I'm investigating why Docker can't authorize with 3rd-party service using credentials ...
0
votes
1answer
35 views

strace vs web browser

I was trying to strace an iceweasel like this: strace -e trace=connect iceweasel And I was expecting to see calls to connect when I load new pages. Surprisingly, there weren't any. Why so? Am I ...
1
vote
0answers
71 views

SIGSEGV: 0x0000000000000000 in ?? ()

I am executing an iperf connection between two UML machines running the following kernel: Linux client 4.1.0-ga61e56d #55 Mon Nov 30 13:51:59 CET 2015 x86_64 GNU/Linux I am working on the TCP/IP ...
0
votes
0answers
57 views

spstack, ptrace stopped a process

My server is busy with sys CPU, so I used pstrace to trace it but no output, so I cancel the command inside putty, and then use pstack to trace it again, but no result return either and I closed the ...
1
vote
0answers
78 views

Tracing syscalls of chromium or setting chromium configuration

Given complex application like for example chromium, does anyone now convenient (and actually working) method of tracing it's syscalls? What i am doing Starting chromium in temporary profile but ...
3
votes
1answer
53 views

How does ssh always manage to reset the terminal attributes?

If I run strace -e trace=ioctl -v ssh some_remote_host I see a line like this: ioctl(0, SNDCTL_TMR_STOP or TCSETSW, {c_iflags=0x6006, c_oflags=0x4, c_cflags=0x 4bf, c_lflags=0xa00, c_line=0, c_cc[...
0
votes
1answer
63 views

Citrix Receiver - 13.2.1 - hangs forever

I had Citrix Receiver working on funtoo linux a while back, but made some changes and could not figure for the life of me what it was. I thought perhaps Funtoo was not stable or there was a conflict ...
3
votes
1answer
202 views

Deleting an empty file, why there are so many sys calls ?

Try to create an empty file and strace the operations that are involved to delete it. The list is very long: touch a strace rm a execve("/bin/rm", ["rm", "a"], [/* 20 vars */]) = 0 brk(0) ...
-1
votes
2answers
69 views

Getting filename based on filehandle number

I am running strace -p 1234 -o strace.out on a system where process it is suspected that process 1234 is performing badly. I see these reads that take almost a minute to complete: read(11, "\0\335\0\...
2
votes
1answer
374 views

Why am I unable to attach `strace` to a kworker process?

As root, I try to attach strace to a running kworker process, without success. root@rasal# whoami root root@rasal:/# cat /proc/sys/kernel/yama/ptrace_scope 0 ...
14
votes
4answers
2k views

What system call is used to load libraries in Linux?

In strace outputs, the paths to the libraries that executables call are in calls to open(). Is this the system call used by executables that are dynamically linked? What about dlopen()? open() isn't a ...
0
votes
0answers
28 views

strace | Who's making syscalls ? | Where are the instructions?

I've been told that strace is used to track all the system calls made while running an application. I see that there are a lot of system calls made even before the first printf ( now write ) call. ...
2
votes
1answer
290 views

Strace - Filedescriptor 3

I am not sure what the filedescriptor number 3 means here? Is this descriptor some kind of pointer to the connection made to the harddrive to get the file datlog.txt? I guess so because the subroutine ...
3
votes
1answer
230 views

BASH: Fifo troubles - seems selective about input

So I am having a problem with a BASH service in Debian 7 that I've been working on for quite a while and that randomly started having trouble with its fifo, or so it seems. It is based on kind of your ...
1
vote
1answer
77 views

Why doesn't /bin/login appear in ps output when someone is logging in

I wanted to monitor what happens when a test user logs in to my CentOS 6.4 system, so I tried this to poll ps for /bin/login and strace the pid when it appears: until [[ $(ps -ef|grep -q [l]ogin)$? -...
1
vote
1answer
79 views

how do applications communicate via sockets

On my computer audio works sometimes and sometimes not. I want to troubleshoot this. First I verified I am using pulseaudio. I did this by strace'ing the pulseaudio process: [pid 2289] send(28, "\0\...
2
votes
1answer
115 views

Monitor and alert user when stty settings change?

A particularly large (~10^6 LOC) program causes my stty settings to change from echo ixon icanon to -echo -ixon -icanon and I would like to find the function in this massive program that causes this ...
2
votes
1answer
137 views

Sending a string to strace for “printf debugging”

While there are command line versions of strace for windows, the defacto GUI equivalent of strace on windows is Sysinternals procmon. In addition to letting you view file, registry, network and other ...
3
votes
1answer
423 views

Decode / summarise strace logs

OK, so it's no secret that strace produces vast amounts of output. (I'm aware there are various options to filter the output a bit.) Are there any tools to process a raw strace log into something ...
2
votes
1answer
500 views

Tracing the node process executing my script from “npm start”

I am attempting to debug a cli node project. Its easier to do npm start than npm install -g . && libgrabber. However, I'd like to run strace on the process. The output of strace -f on the npm ...
2
votes
1answer
378 views

Strace Hello World program

So I am trying to understand systemcalls with the following "Hello World!" program: #include <stdio.h> int main(){ printf("Hello World!\n"); return 0; } and then I run strace on the ...
8
votes
6answers
843 views

why strace ignores my alias for rm?

I have an alias set for my rm command. If I run alias command, this is what I get as output. alias rm='rm -i' Now, when I run the rm command it works fine as expected. rm ramesh rm: remove ...
0
votes
2answers
353 views

How does rsync encode filenames?

By using strace on the active rsync process, I can see output like: read(4, "9\0\0\7\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1\10\0\1"..., 16384) = 61 write(3, "\357\265mD0e\233:\337\...
3
votes
1answer
266 views

strace works for some builtin commands

I'm trying to understand some kernel level concepts in Linux. I was checking on the difference between shell builtin commands and the other executable commands. This wonderful answer clearly tells ...
17
votes
1answer
476 views

Tracing executable without read permissions

I found some surprising behavior on Ubuntu 14.04 when using strace on an executable, which I do not have read permission on. I wonder if this is a bug, or if some standard mandates this obscure ...
2
votes
3answers
694 views

Can strace/ptrace cause a program to crash?

So recently, I was discussing strace with somebody, and they were asking what would happen if you straced a running process just as it was creating a network socket or something similar. Could this ...
7
votes
2answers
655 views

How to determine what instructions a process is executing?

I know about strace and ltrace, but that only tells me what system calls and library calls a process is executing, respectively. I would like to know exactly what instructions a process is executing. ...
1
vote
1answer
584 views

How to use pv with dd?

I'm trying to use dd with pv to write an iso to a usb drive. I did: iso="myiso.iso"; dd if="$iso" bs=1M | pv --eta --size $(ls -l "$iso" | awk '{print $5}') --progress --bytes --rate --wait > /dev/...
4
votes
2answers
1k views

running strace for specific period of time

How to run strace on a user process for specific period of time, say 1 minute, without terminating the user process and without using Ctrl+C? I want to create a script to automating strace execution ...
2
votes
1answer
219 views

Apache suexec won't work with strace

I have an Apache instance with mod_suexec enabled. I'm trying to debug a problem and am starting Apache with strace to try and see what's happening. However, when I start Apache like this: # strace ...
2
votes
1answer
303 views

Make sense of this strace output

Can anyone make sense of this strace output? [pid 25302] read(34, "}B\311\204\n\250\347$\220\266kRb\304a^^\2504\303k\235\227T\223\16\231\306\277\254\256\306", 32) = 32 It's from a Linux system ...
0
votes
0answers
681 views

How do I make strace “decode” AF_NETLINK communication as with ioctl?

strace usually "deciphers" ioctl calls, showing what they mean, even resolving network interface names and so on. But the same operation performed using AF_NETLINK stays opaque in strace. How can I ...